Privacy statement.

1. Who I am

Nick Boon, trading as boons.design, a sole proprietorship established at Fichtestraat 112, 3076 RC Rotterdam, Netherlands. Dutch Chamber of Commerce: 42063070. VAT ID: NL005467542B04. Email: nick@boons.design. Telephone: +31 6 29508251.

I design and develop websites, provide copywriting and supply agreed CMS, portal and maintenance services to business clients in the Netherlands and internationally. This notice concerns processing for my own purposes. Where I act solely on a Client’s behalf, the arrangements with that Client and any required Data Processing Agreement apply.

2. Data, purposes and legal bases

For enquiries through the forms on this website or by email, I process names, business contact details, company names, messages and relevant project information to handle the request. For a natural person contracting personally, pre-contractual steps or contract performance may provide the basis. For organisational contacts, I rely on my legitimate interest in business communication.

For projects, I process briefs, supplied content, feedback, agreements, schedules, approvals and correspondence. The basis is performance of a contract with the natural person or my legitimate interest in delivering and documenting business engagements.

For billing and administration, I process invoice details, transaction references and payment status under statutory duties and, where relevant, contract performance or legitimate interest. A client portal may involve necessary account, access and security data for safe collaboration and support.

Google Analytics 4 is selected for website analytics via Google Tag Manager. I request consent for measurements requiring it. The cookie settings on this website explain this use. Where relying on legitimate interest, I balance my interests against your rights and reasonable expectations.

When you visit this website, Cloudflare, which hosts it, processes technical data such as your IP address and browser details to deliver and secure the website. I rely on my legitimate interest in a secure, working website.

3. Bo and project AI use

Bo is a rule-based website assistant with predefined questions and answers, not a generative-AI chatbot. Bo does not confirm final quotations, availability or contracts. I confirm the final project arrangements.

Any contact details or free text supplied through Bo are handled as an enquiry. Do not submit passwords, API keys, special-category personal data or other sensitive information. Using Bo does not consent to optional analytics or marketing.

I may use tools such as Claude and ChatGPT for development and copywriting. Personal data and confidential client information may be submitted only through an assessed environment, for the authorised project purpose and under appropriate arrangements. The account, features and settings affect the processing involved. Human review remains part of the workflow.

4. Services and recipients

I share information only where necessary for the described purposes. Depending on the service, recipients may include hosting and infrastructure providers, email services, design and collaboration services, AI providers, administrative services, and authorised advisers or authorities with a valid legal basis.

My working environment includes Lark Mail and its linked Gmail route, Vimexx, Cloudflare, Notion, Figma, Claude, ChatGPT and GitHub. Depending on the project, Framer, Supabase, Vercel and Slack may also be used. Google Tag Manager and Google Analytics 4 support the selected website analytics. VS Code is a development environment; connected extensions and external services are assessed by function. Not every provider receives all client data or participates in every engagement. Web3Forms processes what you submit through the contact form and the project request form. Once the project request form is connected to my own intake service, the data of that form is instead processed by Cloudflare (which runs the service and its database), Notion (where requests are stored in my client records) and Resend (which sends me the notification email), and no longer by Web3Forms.

For data processed on a Client’s behalf, the actual providers and roles are recorded for that engagement. A service used for my own administration is not automatically a subprocessor for every Client.

5. International processing

Providers, support or access from other countries may involve processing outside the European Economic Area. Several of the providers named in this notice are established in the United States. A Netherlands hosting provider does not establish that all data remains in the Netherlands.

Where required by the GDPR, transfers must have a valid mechanism, such as an adequacy decision (including the EU-U.S. Data Privacy Framework) or Standard Contractual Clauses, with assessment and supplementary safeguards where needed. You may request information about recipients and safeguards relevant to your processing at nick@boons.design.

6. Retention

I retain personal data no longer than necessary for its purpose or a statutory obligation. Enquiries, project records, account information, logs and correspondence are assessed for necessity and deleted or anonymised when no longer needed. Enquiries that do not lead to a project are deleted within twelve months after the last contact.

Invoices and required tax records are generally retained for seven years; specific statutory exceptions may require longer. This does not require keeping every email, attachment or chat for seven years. An actual dispute may justify retaining necessary information longer while that remains substantiated.

For data processed solely on a Client’s behalf, agreed processing instructions apply. Backups remain access-restricted and expire under the agreed rotation. Relevant deletion instructions are reapplied after restoration.

7. Security and your rights

I must apply appropriate technical and organisational measures proportionate to processing and risk. Only authorised persons may access information they need. Specific security arrangements are recorded for client processing. No system provides absolute protection; following a personal data breach, I assess applicable notification duties.

Where applicable, you may request access, rectification, deletion, restriction and portability, or object. You may withdraw consent without affecting earlier lawful processing. You may always object to direct marketing. I do not take decisions about you based solely on automated processing, and I do not profile you.

Send requests to nick@boons.design. I generally respond within one month and notify you of a permitted extension in time. I request only proportionate identification information. You may complain to the Dutch Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl or another competent supervisory authority.

8. Required information and changes

Some information is necessary to answer enquiries, secure access or perform the agreement. Without it, I may be unable to supply the relevant service. Optional information is identified as such.

I update this notice when processing changes. A revised notice does not itself authorise new consent-dependent use.